The vulnerability identified as CVE-2026-25447 involves improper control over code generation in the Widget Wrangler plugin by Jonathan Daggerhart. It allows code injection, which can be exploited remotely by an attacker with high privileges, leading to complete compromise of the affected system. The CVSS score of 9.1 reflects the critical nature of this vulnerability with network attack vector, low attack complexity, no user interaction, and impacts to confidentiality, integrity, and availability. Affected versions include all releases up to 2.3.9.

Successful exploitation of this vulnerability can result in full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The attacker requires high privileges to exploit this vulnerability remotely. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Widget Wrangler plugin to trusted users only and monitor for suspicious activity related to code injection attempts.